findings_statistics

Creates, updates, deletes, gets or lists a findings_statistics resource.

Overview

Name	findings_statistics
Type	Resource
Id	aws.guardduty.findings_statistics

Fields

The following fields are returned by SELECT queries:

get_findings_statistics

Name	Datatype	Description
count_by_severity	object	Represents a list of map of severity to count statistics for a set of findings.
grouped_by_account	array	Represents a list of map of accounts with a findings count associated with each account.
grouped_by_date	array	Represents a list of map of dates with a count of total findings generated on each date per severity level.
grouped_by_finding_type	array	Represents a list of map of finding types with a count of total findings generated for each type. Based on the orderBy parameter, this request returns either the most occurring finding types or the least occurring finding types. If the orderBy parameter is ASC, this will represent the least occurring finding types in your account; otherwise, this will represent the most occurring finding types. The default value of orderBy is DESC.
grouped_by_resource	array	Represents a list of map of top resources with a count of total findings.
grouped_by_severity	array	Represents a list of map of total findings for each severity level.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_findings_statistics	select	detector_id, region		Lists GuardDuty findings statistics for the specified detector ID. You must provide either findingStatisticTypes or groupBy parameter, and not both. You can use the maxResults and orderBy parameters only when using groupBy. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
detector_id	string	The ID of the detector whose findings statistics you want to retrieve. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
region	string	AWS region (default: us-east-1)

SELECT examples

get_findings_statistics

Lists GuardDuty findings statistics for the specified detector ID. You must provide either findingStatisticTypes or groupBy parameter, and not both. You can use the maxResults and orderBy parameters only when using groupBy. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

SELECT
count_by_severity,
grouped_by_account,
grouped_by_date,
grouped_by_finding_type,
grouped_by_resource,
grouped_by_severity
FROM aws.guardduty.findings_statistics
WHERE detector_id = '{{ detector_id }}' -- required
AND region = '{{ region }}' -- required
;